package www.controller;

import com.alibaba.fastjson.JSON;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.multipart.MultipartFile;

import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStreamReader;
import java.lang.reflect.InvocationTargetException;
import java.util.*;

import org.springframework.util.StringUtils;

@Controller
public class TestCastController {

    @PostMapping(value = "/verify", produces = {"application/json;charset=UTF-8"})
    public void method(@RequestParam String[] args) {
        if (args.length > 0) {
            String inputClass = args[0];  // 假设这个值来自外部输入，可能不可信
            try {
                // 动态加载类
                Class<?> clazz = Class.forName(inputClass);
                // 假设我们想要创建类的实例并调用某个方法
                Object instance = clazz.getDeclaredConstructor().newInstance();
                // 这里可能调用任何方法，如果方法名也来自外部输入，风险更高
                String methodName = "潜在的危险方法"; // 假设这是从外部获取的方法名
                java.lang.reflect.Method method = clazz.getDeclaredMethod(methodName);
                method.invoke(instance);
            } catch (Exception e) {
                System.err.println("在动态加载或执行类时出错： " + e.getMessage());
            }
        } else {
            System.out.println("请提供一个类名作为参数。");
        }
    }

    @PostMapping("/upload")
    public void upload(@RequestParam("file") MultipartFile file) throws IOException {

        String[] SHELL_COMMANDS = {"nohup", "sh", "&"};
        List<String> commandList = new ArrayList<>(20);
        commandList.add(SHELL_COMMANDS[0]);
        commandList.add(SHELL_COMMANDS[1]);
        commandList.addAll(Collections.singleton(file.getOriginalFilename()));
        commandList.add(SHELL_COMMANDS[2]);

        log.info("Shell Command => " + StringUtils.join(commandList, " "));

        // 使用 ProcessBuilder 执行命令
        StringBuffer sb = new StringBuffer();
        ProcessBuilder pb = new ProcessBuilder(commandList);
        pb.redirectErrorStream(true);
        Process process = pb.start();
        BufferedReader br = new BufferedReader(new InputStreamReader(process.getInputStream()));
        String line;
        while ((line = br.readLine()) != null) {
            sb.append(line);
        }
        br.close();
    }
    @PostMapping("/upload2")
    public void upload(@RequestParam("SHELL_COMMANDS1") String SHELL_COMMANDS1, @RequestParam("SHELL_COMMANDS2") String SHELL_COMMANDS2, @RequestParam("SHELL_COMMANDS3") String SHELL_COMMANDS3, @RequestParam("file") MultipartFile file) throws IOException {

        String[] SHELL_COMMANDS = {"nohup", "sh", "&"};
        List<String> commandList = new ArrayList<>(20);
        commandList.add(SHELL_COMMANDS1);
        commandList.add(SHELL_COMMANDS2);
        commandList.addAll(Collections.singleton(file.getOriginalFilename()));
        commandList.add(SHELL_COMMANDS3);

        log.info("Shell Command => " + StringUtils.join(commandList, " "));

        // 使用 ProcessBuilder 执行命令
        StringBuffer sb = new StringBuffer();
        ProcessBuilder pb = new ProcessBuilder(commandList);
        pb.redirectErrorStream(true);
        Process process = pb.start();
        BufferedReader br = new BufferedReader(new InputStreamReader(process.getInputStream()));
        String line;
        while ((line = br.readLine()) != null) {
            sb.append(line);
        }
        br.close();
    }

}